Access is denied when you delete or move an OU to Active Directory

Each new Organizational Unit (OU) that you create within Active Directory has the Protect object from accidental deletion setting enabled by default. This means that when you move the OU to Active Directory, you will receive an error like Windows cannot move object because: Access is denied, even if you have full AD administration rights.

The same happens when you try to delete an OU from Active Directory, where you will receive the error You do not have enough privileges to delete OU, this object is protected from accidental deletion.

So, to delete or move an OU in Active Directory, you will need to disable this setting first and then proceed to your action.

Access is denied when you delete or move an OU to Active Directory

Open Active Directory Users and Computers, click on the View menu, and then click Advanced Features.

Right-click the OU you want to delete/move, and then click Properties.

In the new window, go to the Object tab. Here, uncheck Protect object from accidental deletion.

Note: This tab does not appear if you have not already enabled Advanced Features view.

Then, you are ready to delete or move the OU to Active Directory.

The corresponding setting is also found in the Active Directory Administrative Center (ADAC) in the OU Properties.

Finally, do not forget to turn back on the Protect object from accidental deletion setting to OU if you moved it.